We've just had a situation where a TPA member pushed to pauli as root
which could have messed up the repository's permission. This was
discovered by the post-receive hook which said it was pushed as root,
which is good.

Such a configuration should prevent those issues on most services.

In particular, I add the jump host there to avoid logging in as root
as it's not necessary. The same with the LDAP server, running ldapvi
can (and should) be done as a regular user.

Since gitlab.torproject.org is accessible from outside the internal
network, it can be removed from ssh jump host configuration.

This is:

    ikiwiki2hugo.py --exclude .pytest_cache

With the latest script from:

<https://gitlab.com/anarcat/scripts/-/blob/master/ikiwiki2hugo.py>

... as of right now.

fix title to match original when relevant